PDF static analysis report

Static analysis result for SHA-256 2dd0c896cd5856bb…

SUSPICIOUS

PDF

983.9 KB Created: 2007-10-30 12:39:44 +01:00 Authoring application: Acrobat Distiller 7.0.5 for Macintosh First seen: 2026-05-10
MD5: 66d3a3128974afd8a6d6d8623b3fdb14 SHA-1: 6ca3b80a0a2d688262e597dbe00102edca5f39d0 SHA-256: 2dd0c896cd5856bb9498346effb0a0f806b8d77585a97fbdcf0f77ef76010118
48 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file exhibits multiple indicators of malicious JavaScript execution, including embedded JS streams and JavaScript actions. The presence of an unusually high stream count suggests obfuscation or heap spraying techniques. The extracted artifact 'javascript_obj9603_035.js' is flagged as suspicious. The embedded JavaScript is likely designed to download and execute a second-stage payload, a common technique for initial access.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4357

Heuristics 6

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1401_008.js pdf-javascript-stream PDF /JS object 1401 at offset 0x89A5A 41 bytes
SHA-256: 5b4e1a57bf6476c87a1db4d415eeb42e1477d446a4236b8ae4189d3d8f669dde
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", true);
javascript_obj1402_009.js pdf-javascript-stream PDF /JS object 1402 at offset 0x89AAD 38 bytes
SHA-256: ff0b1e0798b55aee9e494d4b5046c0d747ee05557796f33002cd8f8168a10b67
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", true);
javascript_obj1608_010.js pdf-javascript-stream PDF /JS object 1608 at offset 0x8B1B7 41 bytes
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true);
javascript_obj1610_011.js pdf-javascript-stream PDF /JS object 1610 at offset 0x8B20A 38 bytes
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true);
javascript_obj1997_014.js pdf-javascript-stream PDF /JS object 1997 at offset 0x8C512 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj1998_015.js pdf-javascript-stream PDF /JS object 1998 at offset 0x8C566 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj2378_016.js pdf-javascript-stream PDF /JS object 2378 at offset 0x8DE01 42 bytes
SHA-256: 38771303e5b133f65b24c6712ec9e6df4c1e3ff95fa802e5cb4ed740e2d70e27
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", false);
javascript_obj2379_017.js pdf-javascript-stream PDF /JS object 2379 at offset 0x8DE55 39 bytes
SHA-256: 3bc80ec40ddc2a11c8e2fe6adcd0b03351c4b296889df91d41bcbfba1fd9d4ad
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", false);
javascript_obj3015_018.js pdf-javascript-stream PDF /JS object 3015 at offset 0x92A31 42 bytes
SHA-256: 2927a11b5de8196505468218d0335e4457345716313d2e477e9af256a6453087
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(1, 2, 0, 0, "", false);
javascript_obj3016_019.js pdf-javascript-stream PDF /JS object 3016 at offset 0x92A85 39 bytes
SHA-256: 483e06f06445cc39e6730dde13e0b0119b05238d991f965fa3cc0c1fa3e06089
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(1, 2, 0, 0, "", false);
javascript_obj7050_020.js pdf-javascript-stream PDF /JS object 7050 at offset 0xB3740 198 bytes
SHA-256: 5e654a7ea37aa4f3ec5c8623970856fcd90fff38420022df8421ecee190e78cc
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.vp2");
var vorname = this.getField("vorname.vp2");
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value ;
javascript_obj8697_024.js pdf-javascript-stream PDF /JS object 8697 at offset 0xBDD12 67 bytes
SHA-256: 09950c5f7cdcf7bcb7afe33aedb0d4e67f83c4cf4b6c9e3bc6303077661ed432
Preview script
First 1,000 lines of the extracted script
if (!nichtVor2008(event.value)) {
    event.value = "01012008";
}
javascript_obj8728_025.js pdf-javascript-stream PDF /JS object 8728 at offset 0xBDD85 199 bytes
SHA-256: bc5cabb464bd6493d4edb053df7d42aeb5db3d18737ab9cde38a91aff940bd47
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.ast");
var vorname = this.getField("vorname.ast");
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value;
javascript_obj8965_026.js pdf-javascript-stream PDF /JS object 8965 at offset 0xBE79F 81 bytes
SHA-256: 95e4347047e56819c30ec78ffab652e3737d78809c213bea40919e500188d195
Preview script
First 1,000 lines of the extracted script
wert = Number(event.value);
if (wert > 2.50) {
    event.value = wert / 100;
}
javascript_obj9035_027.js pdf-javascript-stream PDF /JS object 9035 at offset 0xBEA0E 64 bytes
SHA-256: b1eabd7002b3b6d4374372895528a4cc253665c9907fdfbc558550d6bb45b956
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
}
javascript_obj9042_028.js pdf-javascript-stream PDF /JS object 9042 at offset 0xBEA7E 65 bytes
SHA-256: 9b03f9c6665fc798a2d0b145cf056d93bde400c7bcdc6978d3180eeccc2e134d
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
}
javascript_obj9191_029.js pdf-javascript-stream PDF /JS object 9191 at offset 0xC03F4 107 bytes
SHA-256: 762d125085f1d0261264305e5503280bef2062916cc62c9376eebf00aa300b55
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.value = "";
} else {
    checkAlter(event.value,16);
}
javascript_obj9384_030.js pdf-javascript-stream PDF /JS object 9384 at offset 0xC156A 49 bytes
SHA-256: 8569fecb0ff3fd7b4cf948d78dda6932203d54a1de0642c7a42c555125981762
Preview script
First 1,000 lines of the extracted script
dummy = checkEintrittsalter(event.value,1,"eup");
javascript_obj9428_031.js pdf-javascript-stream PDF /JS object 9428 at offset 0xC15C5 49 bytes
SHA-256: 407306df7924e456ea9ed1fc2a7943919b6579b4da5fb41c7ec32969fafd9ea4
Preview script
First 1,000 lines of the extracted script
dummy = checkEintrittsalter(event.value,2,"eup");
javascript_obj9429_032.js pdf-javascript-stream PDF /JS object 9429 at offset 0xC1620 49 bytes
SHA-256: 7b41b160af7236860e3a50fe038f07d64db68c65a2d6a020cddb6827cbce8c3d
Preview script
First 1,000 lines of the extracted script
dummy = checkEintrittsalter(event.value,2,"bwg");
javascript_obj9430_033.js pdf-javascript-stream PDF /JS object 9430 at offset 0xC167B 49 bytes
SHA-256: 369561a26ba3fe24b1145798d3269960111937e93c67ccafc900cb0af6746224
Preview script
First 1,000 lines of the extracted script
dummy = checkEintrittsalter(event.value,1,"bwg");
javascript_obj9431_034.js pdf-javascript-stream PDF /JS object 9431 at offset 0xC16D6 49 bytes
SHA-256: f1a06b9ee397829bbd3abb16ced22a1b1965f4b7255f744497ac35b6a606dcc9
Preview script
First 1,000 lines of the extracted script
dummy = checkEintrittsalter(event.value,1,"bba");
javascript_obj9603_035.js pdf-javascript-stream PDF /JS object 9603 at offset 0xC26C9 237 bytes
SHA-256: 518e1fe2f37fea57fb397cd9512a204da5de881d8b692e9d3695b4c9148f63c0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
datum = event.value;
if (datum != "") {
datum = getDatum(datum);
limit = getDatum('01102007');

if (datum < limit) {
	app.alert(unescape("Der Versicherungsbeginn darf nicht vor dem 01.10.2007 liegen."),1);
	event.rc = false;
}
}
javascript_obj9616_036.js pdf-javascript-stream PDF /JS object 9616 at offset 0xC27FE 75 bytes
SHA-256: 155f990f1a5e481caf976890758f37aef8200c7fc3090083b2b37584eabebdad
Preview script
First 1,000 lines of the extracted script
if (!checkLeistung (event.value,1,"sks")) {
    event.rc = false;
}
javascript_obj9617_037.js pdf-javascript-stream PDF /JS object 9617 at offset 0xC287F 75 bytes
SHA-256: 58be106bdcd66f56bd2f07b5ddb6f228e6c11a2336c6bb04aec60e9c9c2236b5
Preview script
First 1,000 lines of the extracted script
if (!checkLeistung (event.value,1,"rls")) {
    event.rc = false;
}
javascript_obj9618_038.js pdf-javascript-stream PDF /JS object 9618 at offset 0xC2900 75 bytes
SHA-256: 84026863302fef1576a46c9ddd608e117829220c7345d792dd4863343358ef6c
Preview script
First 1,000 lines of the extracted script
if (!checkLeistung (event.value,2,"sks")) {
    event.rc = false;
}
javascript_obj9831_039.js pdf-javascript-stream PDF /JS object 9831 at offset 0xC31A3 61 bytes
SHA-256: 6194bed55306139fa0613692ba8d7df6566d9b3e25e1da418cf5db1d4d1a07bc
Preview script
First 1,000 lines of the extracted script
if (!nichtVor2008(event.value)) {
    event.rc = false;
}
javascript_obj9857_040.js pdf-javascript-stream PDF /JS object 9857 at offset 0xC3C0B 65 bytes
SHA-256: eb5719eb3e51785b68ef3a44f9d246513081068502558bb59c2e44890eb06512
Preview script
First 1,000 lines of the extracted script
if (!checkGeburtsdatum(event.value)) {
    event.rc = false;
}
javascript_obj9861_041.js pdf-javascript-stream PDF /JS object 9861 at offset 0xC3D5E 37 bytes
SHA-256: ca5a1671037d35dad4c481400f13d4d3c71237bb8aa0a0c108da1f6b31875b80
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 12, false, 0);
javascript_obj9886_042.js pdf-javascript-stream PDF /JS object 9886 at offset 0xC43B1 75 bytes
SHA-256: 39ab6d3c064c8f79dfaefa88542dddca651ed6baaf96b33b3a12a38979780a7f
Preview script
First 1,000 lines of the extracted script
if (!checkLeistung (event.value,2,"rls")) {
    event.rc = false;
}
javascript_obj9901_043.js pdf-javascript-stream PDF /JS object 9901 at offset 0xC46C1 40 bytes
SHA-256: 98441f511ffe600f151f747bc76b60e1c401604dfba900d8b6d7ecc6182c0fe5
Preview script
First 1,000 lines of the extracted script
AFRange_Validate(true, 500, true, 2000);
javascript_obj8752_044.js pdf-javascript-stream PDF /JS object 8752 at offset 0xBDEB1 349 bytes
SHA-256: 996fc70e5de6677bdf952e8fbd0dc7b163da9aa135aa8ec75002e7168ddec1b7
Preview script
First 1,000 lines of the extracted script
var nachname = this.getField("nachname.vp1");
var vorname = this.getField("vorname.vp1");
if ((vorname.value == "") && (nachname.value == "")) {
    nachname = this.getField("nachname.ast");
    vorname = this.getField("vorname.ast");
}
var trenner = (vorname.value != "") ? ", " : "";
event.value = nachname.value + trenner + vorname.value ;

Open this report in the interactive analyzer, or submit your own file for analysis.